Neighborhood HealthSource, a Minneapolis-based community health center, has notified patients that a data security incident at Aesto, LLC, a business associate that provides healthcare data migration and archiving services, may have exposed their personal and protected health information. Healthcare providers and the vendors they trust with patient records have a responsibility to safeguard that sensitive information from unauthorized access.
Neighborhood HealthSource’s Data Breach Investigation
Neighborhood HealthSource relies on Aesto, LLC (also known as Aesto Health), a Birmingham, Alabama-based healthcare technology company, to provide secure data migration, legacy data archiving, and electronic health record exchange services. According to a notice Aesto sent on behalf of Neighborhood HealthSource, Aesto experienced a network security incident that impacted a limited portion of its Amazon Web Services (AWS) infrastructure. Aesto has stated that upon learning of the issue, it commenced a prompt and thorough investigation and worked closely with outside cybersecurity professionals who specialize in incidents of this kind.
After an extensive forensic investigation and a manual review of the affected files, Aesto confirmed that an unauthorized actor may have accessed or acquired a limited amount of protected health information belonging to patients of Neighborhood HealthSource and other healthcare providers that rely on Aesto’s services. The investigation determined that the unauthorized access to Aesto’s AWS environment occurred between on or about December 2, 2025 and December 18, 2025. Aesto notified Neighborhood HealthSource, as the HIPAA covered entity responsible for the affected records, of the incident, and Neighborhood HealthSource then began notifying affected patients directly.
Public reporting indicates that Neighborhood HealthSource is only one of more than two dozen healthcare provider clients affected by the Aesto security incident, a group that reportedly includes hospitals, clinics, and health systems across multiple states. Because Aesto serves as a data processor and archiving vendor for so many covered entities, the true scope of the breach has been difficult for outside observers to pin down precisely. Industry reporting has estimated the incident has affected hundreds of thousands of patients across all of Aesto’s affected clients combined, with some individual providers reporting tens of thousands of impacted patients apiece.
Neighborhood HealthSource operates as a network of community health centers serving the Minneapolis area, providing primary care, dental, and behavioral health services to patients regardless of their ability to pay. Community health centers like Neighborhood HealthSource often serve populations who may have fewer resources available to respond to a data breach, making the protection of their sensitive health and financial information especially important. When a community health center works with an outside vendor to migrate or archive electronic health records, that provider is depending on the vendor to maintain security controls at least as strong as its own.
Aesto has stated that it has taken many precautions to safeguard the sensitive data in its possession and continually evaluates and modifies its security practices in light of the incident. Both Aesto and Neighborhood HealthSource have made credit monitoring and identity theft protection services available to affected individuals as a precaution, even though Aesto has not confirmed that any of the compromised information has actually been misused for identity theft or fraud.
When a healthcare provider entrusts a vendor with patients’ Social Security numbers, medical records, and other protected health information, that provider does not get to simply point to the vendor and walk away from responsibility. Under HIPAA and various state consumer protection laws, covered entities like Neighborhood HealthSource remain accountable for ensuring that any business associate handling patient data has adequate safeguards in place. Attorneys are now investigating whether Neighborhood HealthSource and Aesto took reasonable steps to prevent this kind of unauthorized access, and whether their response to the incident, including the timing of notification to affected patients, was consistent with applicable breach notification laws.
When Did This Breach Occur?
According to Aesto’s notice, the unauthorized access to its Amazon Web Services infrastructure occurred between on or about December 2, 2025 and December 18, 2025, when Aesto detected the network security incident. Aesto states that after an extensive forensic investigation and manual document review, it confirmed that a limited amount of sensitive information belonging to Neighborhood HealthSource’s patients had been accessed or acquired without authorization during that window. Neighborhood HealthSource then began sending notification letters to affected patients.
What Information Was Breached?
Neighborhood HealthSource’s notice indicates that the information involved may include patients’ names along with protected health information tied to their care at the health center. Because the underlying incident affected Aesto’s broader infrastructure, other individuals connected to Aesto’s healthcare provider clients have reported that additional data types, including Social Security numbers, driver’s license numbers, financial account numbers, and health insurance information, may also have been compromised depending on the specific records a given provider had stored with Aesto.
What You Can Do
Neighborhood HealthSource and Aesto are offering affected individuals complimentary access to Experian IdentityWorks for 24 months, which includes credit monitoring and identity restoration support. To enroll, eligible individuals can visit the Experian IdentityWorks enrollment website and provide the activation code included in their notification letter. Beyond enrolling in monitoring, affected patients should regularly review their financial account statements, medical bills, and insurance explanation-of-benefits statements for any charges or services they do not recognize. Placing a fraud alert or security freeze with the three major credit bureaus, Equifax, Experian, and TransUnion, adds an extra layer of protection against someone opening new credit in your name. If you notice any suspicious activity, report it promptly to your financial institution, local law enforcement, and your state Attorney General’s office.
File a Data Breach Lawsuit Against Neighborhood HealthSource
If you received a notice that your information was involved in the Neighborhood HealthSource data breach, you may have legal options. A class action lawsuit could hold Neighborhood HealthSource and Aesto accountable for failing to adequately protect the sensitive patient information entrusted to them, and could result in compensation for those affected.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
